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Abstract 


The question how a 5G communication system will look like has been addressed intensely in 
numerous research projects and in standardization bodies. In the massively connected 
world of the “Internet of Things” (IoT), it is getting more and more important to be aware 
of where all these “things” are located. Mobile radio-based technologies envisaged for a 5G 
system will play an essential role in providing high-accuracy positioning of the “things.” In 
this work, we will first address the fundamental Cramér-Rao lower bound (CRLB) of time of 
arrival (TOA) estimation in an orthogonal frequency-division multiplexing (OFDM)-based 
system (such as 4G and 5G) using the pilots. The achievable performance is compared with 
the 3GPP LTE and potential future 5G requirements. The Ziv-Zakai lower bound (ZZLB) is 
also considered for TOA estimation, as it is tighter than the CRLB for medium to low signal- 
to-noise ratios (SNRs). We show how to optimize the waveform in order to reduce the TOA 
estimation error. Then, we describe some practical low-complexity maximum likelihood 
(ML) methods for TOA estimation with enhanced first-arriving path detection. Simulation 
results show that such adaptive ML methods can in some cases (e.g., line of sight) achieve a 
performance close to the CRLB. Finally, we will briefly discuss cooperation-based position- 
ing, which will become increasingly important for massively connected IoT. 


Keywords: Cramér-Rao lower bound, Ziv-Zakai lower bound, time (difference) of arrival, 
radio-based positioning, cooperative positioning 


1. Introduction 


Mobile communication has become an integrated part of our daily lives. Today, whereas the 
state-of-the-art fourth generation (4G) wireless standard long-term evolution (LTE) has been in 
use for a decade, the fifth generation (5G) wireless standard called new radio (NR) is being 
specified for diverse applications in the next 10 years. In the first 5G NR release, Release 15, 
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mainly the enhanced mobile broadband (eMBB) use cases have been considered. The ultra-reliable 
low latency communication (URLLC) use cases will be addressed in Release 16. Other use cases 
such as massive machine-type communication (mMTC) as well as the internet of things (IoT) are 
expected to be taken into account later. Although 5G NR standardization is still underway, a 
significant amount of details have already been agreed on. One important feature of 4G LTE 
and 5G NR is the support for accurate positioning of a user equipment (UE), i.e., the estimation 
of the position of the UE or the “thing” in the network, such as a car, a drone, etc. Especially in 
the massively connected world of IoT, it is getting more and more important to be aware of 
where all these things are located. Mobile radio-based technologies envisaged for a 5G system 
will play an essential role in providing high-accuracy positioning of the “things.” 


2. Overview on mobile radio positioning techniques 


The 2G, 3G, and 4G cellular communication standards have specified a variety of positioning 
methods. These methods infer position information from received signals and include Cell-ID, 
received signal strength (RSS) as well as time difference of arrival (TDOA)-based methods. All 
these methods have in common that they use downlink signals. Propagation delay-based 
methods like TDOA require signal reception from three base stations (BSs) in order to calculate 
a 2D UE position as shown in Figure 1. To estimate the position in 3D, at least four BSs are 
needed. In many environments, the probability of receiving signals from three different BSs with 
sufficient quality has shown to be quite low. In the example shown in Figure 1, it is not possible 
to get a position fix for UE3 since it receives the signal from BS3 only. For increasing adjacent BS 
hearability, the idle period downlink (IPDL) has been implemented in 3G UMTS [1]. LTE has 


Figure 1. Today’s cellular mobile system, where UEs require signals from at least three different BSs in order to calculate 
their position in 2D. The UEs operate independently from each other without any cooperation. 
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addressed this problem since its Release 9 with the specification of positioning reference signals 
(PRSs) [2]. However, multipath and non-line-of-sight (NLOS) propagation are still present and 
potentially cause severe positioning performance degradations. Usually, the probability of 
receiving signals under line-of-sight (LOS) condition decreases with increasing distance between 
BS and UE [3]. 


For 4G LTE, UE positioning is defined in [4]. There are two protocols, the LTE Positioning 
Protocol (LPP) [5], which specifies the protocol between the UE and the so-called location 
server, and LTE Positioning Protocol Annex (LPPa) [6], which specifies the protocol between 
the BS and the location server. There are the following methods in Release 13 [4]: (1) Observed 
TDOA (OTDOA), (2) assisted-global navigation satellite system (A-GNSS), (3) enhanced cell- 
ID (E-CID), (4) barometric sensor, (5) terrestrial beacon system (TBS), (6) WLAN, and (7) 
Bluetooth. The first three techniques have been in the standard since Release 9, and the next 
four have been added in Release 13 to fulfill the new FCC wireless indoor E-911 location 
accuracy requirements from 2015 [7]. A-GNSS is used to provide assistance data to the GNSS 
receiver in the UE. E-CID is a coarse positioning method, which can use the Cell-ID, the 
received signal power/quality at the UE, timing information, and the angles of arrival (AOA) 
at the BS to estimate the position. Barometric sensor positioning uses a barometric sensor to 
identify the height of the UE. WLAN positioning can use the (B)SSID of WLAN access points 
near the UE together with the RSS indicator (RSSI) and round-trip time. Bluetooth positioning 
can use Bluetooth beacon identifiers near the UE together with the RSSI. TBS can use Metro- 
politan Beacon Systems (MBS), a network of ground-based transmitters broadcasting high- 
precision time signals similar to the global positioning system (GPS). 


LTE Release 11 also adds support for uplink TDOA, which means that the UE sends pilots for 
positioning and several BSs to measure the TDOA. LTE Release 13 and, recently 14, addressed 
positioning for “further enhancements for enhanced machine-type communication” (feMTC) 
and NarrowBand IoT (NB-IoT). 


We focus here on downlink OTDOA, which is a multilateration method, as shown in Figure 1. 
Several BSs send the PRS to one UE, which estimates the TDOA with respect to some reference 
BS, and feeds back the (quantized) TDOA to the location server. Each TDOA measurement 
restricts the location of the UE to a hyperboloid. The location server then estimates the position 
of the UE based on the TDOAs. 


The LTE standard specifies a set of downlink pilots or reference signals (RSs) with different 
time-frequency patterns, such as those shown in Figure 3. Note that the BS does not transmit 
on the data channels in the resource blocks used for the PRS. There are six possible frequency 
shifts for BSs operating at the same frequency. The PRS is repeated periodically. In order to 
further increase precision, the PRS of certain BSs can be muted in certain repetitions to reduce 
interference. The PRS of other BSs can be sent on the same or in a different frequency band as 
the serving BS. An overview can be found in [8]. 


2.1. UE positioning requirements 


Services and applications based on accurate knowledge of the user position, such as location- 
sensitive billing, fraud detection, fleet management, and intelligent transportation systems 
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have become increasingly important. In 1996, the United States Federal Communications 
Commission (FCC) mandated all US wireless network operators and mobile devices to pro- 
vide location information for Enhanced-911 (E-911) [9]: caller location must be provided to 
public-safety answering points (PSAPs) with 50 m accuracy for 67% of calls and 150 m accu- 
racy for 95% of calls. In 2015, the FCC published the wireless indoor E-911 location accuracy 
requirements [7]. They include but are not limited to that within 6 years; for 80% of all wireless 
911 calls, the horizontal location of the caller must be known within 50 m and the vertical 
location must fulfill some z-axis metric that still has to be approved by the FCC. Alternatively, 
the so-called dispatchable location can be provided, which is the address of the building 
together with a floor or apartment number. Furthermore, barometric sensor data must be 
made available for all UEs that support it. 


The FCC requirements can be met by GNSS such as GPS in many environments. Typically, the 
GPS for civil applications can provide a positioning accuracy of a few meters. However in 
some cases, such as indoors or in urban canyons, the GPS signal may be too weak or scattered 
too much to provide the required accuracy. As a complement, wireless systems like GSM, 
UMTS, or LTE provide good coverage in such scenarios. Accordingly, requirements for TOA 
and TDOA measurements have been specified in 3GPP LTE Release 9 to ensure accurate UE 
positioning even under bad conditions (e.g., with channels quickly varying and SNRs being as 
low as —13 dB). Depending on use cases, 5G will have much stricter requirements; e.g., for V2X 
vulnerable road user discovery, accuracy as high as 10 cm may be required (see [10]). 


2.2. What can 5G new radio (NR) do better for positioning? 


3GPP, which is responsible for 5G standardization, has decided that OFDM will be used for 5G 
NR, as in 4G LTE. Specifically, the following parameters have been agreed on (see [11]): 


1. Subcarrier spacing (SCS): for 4G, the subcarrier spacing is fixed to 15 kHz, except for 
multicast-broadcast single-frequency network (MBSEN) services for which a subcarrier 
spacing of 7.5 kHz is used. In contrast, 5G will deploy multiple subcarrier spacings 
ranging from 15 to 480 kHz, which are all integer multiples of 15 kHz. 


2. Cyclic prefix (CP): 5G has adopted the same approach as 4G, where the CP can be either 
normal CP (NCP) or extended CP (ECP). The choice of the CP depends on the expected signal 
dispersion. In 5G, ECP is expected to be associated with the 60 kHz subcarrier spacing. 


3. Frame structure: in 4G, the transmission time interval (TTI) was specified to be 1 ms, which 
is the subframe duration, and a subframe consists of two slots. In 5G, a subframe can 
contain 1, 2, 4, 8, 16, and 32 slots. For both 4G and 5G, each slot consists of 14 OFDM 
symbols. 


4. Bandwidth: a single carrier of 5G is expected to support a bandwidth of up to 100 MHz for 
carrier frequency below 6 GHz, and up to 400 MHz for high (millimeter wave) carrier 
frequency. This leads to much higher accuracy for radio-based positioning. 


Until now, 5G NR positioning has not yet been specified. Hence, this work will take 4G as an 
example. As 4G and 5G both employ OFDM and similar frame structure, the results obtained for 
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4G can be reasonably extrapolated to 5G; e.g., with a similar pilot signal density for TOA 
estimation, when 5G has five times the bandwidth of 4G, it can achieve five times as high 
positioning accuracy. Also, the following features envisaged in 5G are beneficial for positioning. 


e Higher frequencies and large signal bandwidths: larger signal bandwidths allow a better 
resolution of the wireless channel in time, and therefore, more accurate estimation of 
multipath components, in particular, their signal propagation delays. In addition to the 
conventional frequency bands from about 450 MHz to 6 GHz ([12], Section 5.5), 5G will 
also use millimeter wave frequency bands, e.g., at 28 or 60 GHz. At those frequencies, the 
attenuation of the channel is high, since the antennas need to be smaller for a similar 
directivity. This increases the probability of LOS reception conditions as any NLOS condi- 
tion is likely to be blocked and reduces the risk of positioning errors due to the NLOS bias. 
Furthermore, higher frequencies together with massive multiple-input-multiple-output 
(MIMO) schemes allow tracking the individual terminals by beam forming with antenna 
arrays more accurately (see e.g., [10]). 


e Dense networks: a denser grid of BSs reduces distances between UEs and BSs. With lower 
BS-UE distances, the probability of LOS signal reception increases. This reduces the risk of 
positioning errors due to the NLOS bias. 


e Device-to-device (D2D) communications with a large number of connected devices: additional 
links provide additional signal observations that can be exploited to determine 
pseudoranges among UEs as shown in Figure 2. With D2D communication capabilities, 
UEs are inherently receiving signals from each other. Signal processing entities for D2D 
communications, in particular synchronization and channel estimation units, can be 
reused for signal propagation delay estimation. D2D communication provides a meshed 


() 


N 


5G links 


Figure 2. 5G envisages D2D communications, where UEs may cooperate with each other for positioning. If the mesh of 
D2D links is sufficiently dense, positioning works even if there are less than three BSs visible to individual UEs. 
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network structure rather than the star-shaped one for today’s mobile cellular systems. 
Assuming a fully connected mesh as a best case, the number of D2D links grows quadrat- 
ically with the number of UEs Nur. As the number of unknown positions increases 
linearly with Nur, D2D links provide significant redundancy in the number of observa- 
tions to neglect links under disadvantageous propagation conditions like low SNR, 
NLOS, severe multipath, bad geometry, etc. Even unknowns like NLOS bias terms can be 
estimated with a sufficient number of observations. Consequently, precise positioning can 
be achieved by exploiting cooperation among UEs. 


3. Cramer-Rao and Ziv-Zakai lower bound in an OFDM system 


In this section, we will describe the Cramér-Rao lower bound (CRLB) and Ziv-Zakai lower 
bound (ZZLB) for T(D)OA estimation in an OFDM system transmitting over an additive white 
Gaussian noise (AWGN) channel. The CRLB follows the derivation in [13], but additionally 
allows a frequency shift of the subcarriers, which is needed for NB-IoT. Consider the following 
OFDM transmit signal (without the CP) 


sıln] = Er a Sı[k] exp («+ on) 0<x<1 (1) 
VN Xp N . 


where Sık] is the signal allocated to the kth subcarrier of the Ith OFDM symbol, N is the 
number of subcarriers and x shifts the subcarriers in frequency domain. Let us transform this 
signal into continuous time domain to estimate the continuous delay 7, the TOA. By removing 
the periodic replicas in frequency domain by multiplying with the rectangular function 


1 for — <w< E 
rect(w) = i T` T (2) 
0 else, 


we have the frequency-domain representation 


N/2-1 


Si(w) = N `> sie (o- (&+ 7), (3) 


k=—N/2 


where T is the sampling time interval. In time domain, the same signal becomes 


N/2-1 


1 t 
s(t) = —= Si[k| exp | j27(k + K) — }. 4 
=F DSi p (RK +x) 57) W 
Then, we sample this signal delayed by t for n = 0,...,N — 1, 
N/2-1 1 
sr ıln] :=sı(nT — t) = — > Silk] exp (j2r(k + «)Af(nT — t)) Af = —. (5) 


VN k=-N/2 N 
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Now consider the system transmitting over an AWGN channel 
Yı [n] = sr ıln] +2] [n], ZI [n] 2 CN (0, 0°) $ (6) 
The variance and the CRLB for any unbiased estimate T of t from the measurement vector 
y = [y(0],...,y[N — 1]]’ become ([14], Chapter 3) 
1 


Var(T(y))>CRLB(T) = 
E|(SInpylz))’| 


(7) 


as long as the regularity condition E rt] =0 Vris fulfilled. For the AWGN channel, the 


CRLB can be expressed as 
= g” 
CRLB(T) = ee ; (8) 
2 2 D è SR, ıln n]? 


n=0 


when N symb OFDM symbols are used to estimate T. 


This expression can be simplified as 


N-11] g N- N/2-1 g 
a spilt >> m a ilk] exp (j2r(k + x)Af(nT — 1)) 


ap? NRZ N/2=1 2 
an (m+ x) (K + 9S} exp (177 (kn) Nö 
m=—N/2k=—N/2 


(9) 
where the Kronecker delta ông comes from the orthogonality of the subcarriers, i.e., 
N-1 
exp (j27Af(m — k)nT) = Nông. (10) 
n=0 
In this way, we obtain the CRLB [13] 
J 
Var{T}>2CRLB(T) = . (11) 
N symb— 1. N/2- 1 2 2 
Br2(Af) D È kto Sik 
I1=0 k=-N/2 


As the PRS does not carry any time stamp, there are ambiguities in the TOA estimation. 
Therefore, TDOA estimation is usually used. The CRLB for TDOA estimation is 


CRLBrp = CRLB (ĉef) + CRLB(T), (12) 
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where Tret is the time delay to the reference BS, which, e.g., serves the UE, Treg is its estimate, 
and we assume that T and T,er are statistically independent. We will focus on CRLB(T) in the 
following and abbreviate its standard deviation as 


OCRLB = CRLB (T) $ (13) 


Note that this is the standard deviation of the TOA, which can be translated to a standard 
deviation of the distance d by multiplying with the speed of light in free space co, i.e., 


CRLB (2) = coCRLB(?), (14) 


where d is the estimate of d. 


3.1. Achievable TOA measurement accuracy using pilots in 3GPP LTE 


Different pilots or RSs have been specified in LTE, e.g., the primary synchronization signal 
(PSS), the secondary synchronization signal (SSS), and the cell-specific RS (CRS). In general, all 
or parts of these pilots can also be used for TDOA estimation (see Figure 3). The graphs in 
Figure 4 show ocrip, computed according to Eqs. (11) and (13), using different pilots specified 


in LTE and one receive antenna, with E; := E { |Si(k) P} being constant for the pilots specified in 


LTE systems, such as the PSS, SSS, CRS, and PRS. Here, a subframe of 1 ms contains 14 
consecutive OFDM symbols, as in the case of the LTE normal CP. The PSS, SSS, CRS, and PRS 
are mapped to the corresponding resource elements [2]. Note the lowest bound (i.e., the 
highest measurement accuracy) is obtained by utilizing all the four pilots (PSS, SSS, CRS, and 
PRS) simultaneously. Among all available pilots in LTE, the PRS, as expected, achieves the 
highest accuracy in terms of the CRLB since it almost spans the whole bandwidth and there are 
also more PRS symbols available than, say, CRS symbols (see Figure 3). As it can be seen, using 
the PRS instead of the CRS can have a gain of about 3 dB. When CRS in addition to PRS is 
used, about 1 dB can be gained. As shown in the next section, an adaptive ML detector can 
have an estimation accuracy close to the CRLB, especially for scenarios where the first path is 


dominant. 
OFDM symbols 
F Abbreviations 
PCHICH/PHICH/ Physical control format in- PCFICH 

m PDCCH dicator channel 

£ 4 Physical hybrid-ARQ in- PHICH 

F E rks dicator channel 

“ Physical downlink control PDCCH 
H crs channel 

y 


Figure 3. An example LTE signal pattern with a cell-specific reference signal (CRS) and positioning reference signal (PRS) 
in a single physical resource block (PRB). 
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Figure 4. CRLB for TOA measurement using different pilots in one subframe. 


3.2. CRLB for LTE and LTE NB-IoT 


In what follows, we will focus on the PRS. LTE supports several bandwidths of the PRS, from 6 
to 100 physical resource blocks (PRBs), consisting of 12 subcarriers each. The PRBs are placed 
symmetrically around the carrier frequency. Then, the usable bandwidth in the downlink is 
1.095 to 18.015 MHz, where the additional 15 MHz come from the additional unused DC 
subcarrier. K = 0 corresponds to the conventional LTE downlink without considering the DC 
subcarrier. For bandwidths between 1.4 and 20 MHz [12], the (nominal) sampling rate of the 
system is T = 16T, to Ts, where T, = 1/30.72 us=32.552ns is the LTE basic time unit. The 
(nominal) FFT size changes accordingly from N = 128 to 2048 (c.f. Table 1). 


Consider the PRS for anormal CP when there are only one or two physical broadcast channel 
(PBCH) antenna ports ([2], Chapter 6.10). In each subframe for positioning, the PRS occupies 8 
out of 14 OFDM symbols, as shown in Figure 3. In each PRB, two subcarriers are allocated for 
the PRS in each of the eight OFDM symbols. If we average over the six different cyclic shifts, 
the PRS corresponds to an equal power allocation over all usable subcarriers. Figure 5 shows 
the CRLB for different bandwidths of the PRS for a single subframe having the same subframe 
sum power allocated to the PRS 


Nsymb—1 N/2-1 


Pua >. >, ld: (15) 


I=0 k=—N/2 


In 5G, for Af = 15kHz, the supported range of channel bandwidths is from 5 to 50 MHz (c.f. 
Table 1). In general, the usable downlink bandwidth is larger for the same channel bandwidth, 
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Channel bandwidth Number of PRBs Usable downlink bandwidth Nominal FFT size T 
NB-IoT: 200 kHz 1 180 MHz 128 16T; 
LTE: 1.4 MHz 6 1.095 MHz 128 16T, 
LTE: 3 MHz 15 2.715 MHz 256 8T, 
LTE: 5 MHz 25 4.515 MHz 512 4T; 
LTE: 10 MHz 50 9.015 MHz 1024 2T; 
LTE: 15 MHz 75 13.515 MHz 1536 4/3T; 
LTE: 20 MHz 100 18.015 MHz 2048 W's 
5G: 5 25 4.5 MHz 512 4T; 
5G: 10 52 9.36 MHz 1024 2T; 
5G: 15 79 14.22 MHz 1536 4/3T, 
5G: 20 108 19.44 MHz 2048 Ts 
5G: 25 133 23.94 MHz 3072 2/3T; 
5G: 40 216 38.88 MHz 4096 Ts/2 


5G: 50 270 40.5 MHz 4096 T;/2 


Table 1. Some 4G LTE parameters [12] and 5G NR parameters for Af = 15kHz [11]. 


as more physical resource blocks are used. No PRS has been standardized for 5G yet. To 
estimate the future accuracy of 5G, we assume the LTE PRS but extended to the different 
number of PRBs. As we can see in Figure 5, the accuracy of the same channel bandwidth is 
expected to be slightly better than in LTE since the usable downlink bandwidth increases. 
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Figure 5. CRLB of LTE (N)PRS with different bandwidths but with the same sum power for a single subframe (solid), 
including 5G performance estimate using the LTE PRS adjusted to the different number of physical resource blocks 
(dashed). 
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Now let us consider IoT. Accurate positioning for IoT is challenging due to the small channel 
bandwidth for machine type communication (1.4 MHz in LTE-M) and NB-IoT systems 


(200 kHz in LTE NB-IoT). As ocrıg = © (aN yt) , the positioning accuracy reduces consider- 


ably compared to a 10 MHz PRS with the same energy (c.f. Figures 5 and 6). Therefore, the PRS 
has been optimized for LTE-M, and a new narrowband PRS (NPRS) has been introduced for 
NB-IoT in Release 14 [15]. Those improvements decrease the so-called periodicity of the PRS or 
increase the length of the PRS, up to about 0.5 s. This increases the energy spent on the PRS and 
decreases the efficiency of the system meaning that fewer resources can be allocated to data 
transmission. In order to increase the effective bandwidth of the PRS, which decreases the 
energy and time needed for the PRS, LTE-M supports frequency hopping, but NB-IoT cur- 
rently only supports artificial frequency hopping by configuring the PRS onto multiple NB-IoT 
carriers [15], see e.g., [16] for a study on its performance. Frequency hopping in NB-IoT can be 
more difficult than in LTE-M since NB-IoT can operate in individual small unused gaps in the 
spectrum, while LTE-M uses (parts of an) LTE channel. Similarly, in order to increase the 
effective bandwidth, carrier aggregation can be employed [17]. 


In contrast to the conventional LTE downlink, we have «x = 1/2 for NB-IoT —at least in guard 
band and standalone operation mode. NB-IoT occupies one PRB, i.e., the 12 subcarriers 
—6,...,5 in the downlink [2]. The NPRS occupies at least 10 subframes consisting of 14 
subsequent OFDM symbols each, which are all used for the NPRS in guard band and 
standalone operation mode [2]. Depending on the cell ID, the NPRS is shifted circularly in the 
occupied subcarriers by v € {0, ...,5} subcarriers. In each subframe, each subcarrier is allocated 
twice with the NPRS, except for subcarriers k = v and k = v — 6, which are allocated four 
times. The allocation pattern is similar to the one for the PRS (c.f. Figure 3). Let P,,mp denote 
the power of each allocated symbol in a subcarrier. Then for one subframe, 
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Figure 6. CRLB of the LTE NPRS with different numbers of subframes and of the LTE PRS for a 10-MHz channel. 
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13 N/2-1 


1 
(k + KP ISIK]? = == (4v? — 20v + 347) Psum, Psum = 28Psymb (16) 
28 


I=0 k=-N/2 


holds, where the nominal FFT size for NB-IoT is N = 128 (c.f. Table 1). That means simplifying 
the average CRLB for TOA estimation yields 


|, 280° 
8772 (Af)’(333 + 2/3)Psum 


CRLByprs, avg (T) (17) 


As for the LTE PRS, this corresponds to an equal power allocation on all usable subcarriers, but 
with x = 1/2 instead of x = 0. As shown in Figure 6, the positioning accuracy of the NPRS, 
even with 1280 subframes, is still a bit worse than the 10 MHz PRS with one subframe. 


3.3. ZZLB and waveform optimization 


In LTE, all PRS and NPRS symbols are sent with the same power. But when we consider the 
CRLB in Eq. (11), the optimum power allocation strategy is to allocate all power to positioning 
symbols in those subcarriers that are furthest from the center frequency. That means, com- 
pared to Eq. (17), we get for one subframe 


ae ae 121 
>, S ers] = 14-2 - 5.5? Poy = 847Psymb = —— Psum- (18) 
I=0 k=—N/2 4 


So Ocrız improves by a factor of about 1.6. Consequently, the TOA estimation time with the 
NPRS can be reduced from about 0.5 to about 0.31 s, in order to achieve the same accuracy. 


In practice, however, when we approximate the power allocation by a Dirac in the edge 
frequencies, this waveform is not optimal for all SNRs in general—especially at low SNR— 
since its autocorrelation has got large sidelobes, which the estimator can confuse with the main 
lobe [18] (see Figure 7). There are tighter bounds for the estimation error that take this into 
account, e.g., the ZZLB [19, 20], which is given by 


Rectangular ( œ = 0.5, = 0) 


—— Dirac (y = 1) 


p(Br) 


Triangular with a = 1 


Figure 7. Comparison of the normalized autocorrelation of the Dirac-rectangular and the triangular waveform. 
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co 


Ta 
Psum 1 agg 
ZZLB = | “(1 _ el) 2 (1- 7) dt, (x)= or | eldu, (19) 


x 


for TOA estimation, where we assume the prior information that 7 is uniformly distributed in 
[0, Ta] with the observation time interval Ta and where p(t) is the real-valued normalized 
autocorrelation function of the positioning symbols. In LTE, the UE gets the required prior 
information on the expected delay via the LPP [5]. Note that the optimum waveform w.r.t. 
ZZLB also depends on the SNR, in contrast to the CRLB. Therefore, depending on the region of 
the SNR of interest, the waveform that minimizes the ZZLB may be different. 


In [18], the optimization w.r.t. ZZLB in continuous time over a so-called triangular waveform 
with the parameter a € [0,1] and over a Dirac-rectangular waveform with parameter y € (0, 1] 
with power spectral densities 


2 A(1—2a B 
, je-03- Zn ish, 
[Sei (f)|° = 5 (20) 
0 fl > 5 
1- B B B 
[EDD m 
Sa = i (1) 
0 lf] >= 
' 2 
is shown, where B is the bandwidth (see Figure 8). Figure 9 shows the ZZLB, with. 
OZZLB ‘= V ZZLB. (22) 


For a very low SNR, the ozzıss are slightly below Ta/ V12, which is the standard deviation of 
the uniform distribution we use as a priori information for the ZZLB. The CRLB does not 
consider the a priori information. For a high SNR, the ZZLB converges to the CRLB. For NB- 
IoT, we have B=11Af = 165 kHz and thus T, ~60.6us for the same configuration as in [18]. 
There it was shown that the optimal triangular waveform is the one with a = 1, but for the 
Dirac-rectangular waveform, the optimum value of y depends on P;um/ 0. For small P,um/07, a 


[Sti (FI? [Sa (F)? 


- B/2 B/2 = B/2 B/2 


(a) (b) 


Figure 8. Power spectral density of the triangular and the Dirac-rectangular waveform (a) Triangular, (b) Dirac-rectangular. 
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Figure 9. ZZLB of the Dirac-rectangular waveform and the triangular waveform for different parameters a, y and the 
unrealistically large Ta = 60.6 us. 


triangular waveform is better than a Dirac-rectangular waveform, but for large Psum/o, it is 
the other way round. We observe the same behavior in Figure 9. 


Sampling the Dirac-rectangular waveform with y < 1 or the triangular waveform with a = 1 
could be a good candidate for the power allocation of the PRS for IoT in 5G, but the position- 
ing accuracy will not improve by the full factor of 1.6, corresponding to the CRLB optimal 
allocation. 


4. Practical TOA estimation based on first tap detection 


4.1. Maximum likelihood (ML) timing estimation 


The reference signal sı(n), such as CRS and/or PRS, is embedded in the received signal y,(1). 
The target of the TOA estimation is to determine the position 7 in the received signal y,, say, 
using the maximum likelihood (ML) criterion. Notice that the ML estimator has the asymptotic 
properties of being unbiased and achieving the CRLB [14]. Consider the other paths as inter- 
ference, the ML criterion for timing estimation of the first path reduces to a correlation-based 
criterion. The correlation-based method can be realized in time or frequency domain. In the 
following, we focus on the time domain-based method [13]. 


The received signal y,() is correlated with the replica of the transmitted signal sı(n), i.e., 


Nsymb—1 N-1 


R= So I yıln+dsi(n), te [0,W -1], (23) 
1=0 n=0 
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where W = 2G is chosen as the search window size. To ease the analysis, we first assume sı(n) 
has ideal autocorrelation property, and the power of the transmit signal sı(n) is P,. Then, with 
some derivations, the correlation can be written as 


N symb 1 


R(t) =P, XO M(t- 1) + Rres(t), (24) 
1=0 


where Ryes (t) represents the total residual noise and interference part resulting from correlation 
between sı(n) and y(n + t). 


Assume the channel is unknown but remains invariant for Nsymp OFDM symbols, h(t) = h(t), 
then the noncoherent detector can be employed. The metric for the TOA detection, which is 
also called the correlation profile, is given here by 


A(t) ELIRO} = N? mP2y(t = 7) + PsNeymoo”, (25) 


with y(t) =E HHP}. ESRR) is used to denote the statistical average of IR(H |? over 


multiple subframes containing RS signals. In LTE, a group of several consecutive subframes 
containing the RS is sometimes referred to as a positioning occasion. Usually, an LTE position- 
ing measurement is done on one or more occasions. 


4.2. Signal arrival region determination 


We now determine the arrival region of the RS. For a multipath channel, the signal arrival 
region will have multiple taps corresponding to the taps of the channel. The signal paths are, 
therefore, reflected by the channel paths. A moving sum is computed as 


u+G-1 


Awalu)= > E{IR®P}  wel,G-1 (26) 


t=u 
The signal can be regarded as arrived in the time region 


wstsw+G-1l st uo = argmax {Awin(u)} (27) 
u 


When t- T>Lort—-T<.(, only the noise power related term, the noise floor N, :=P;N, ah 


2 


remains in the correlation. Nr, which is used here as 0°, can be calculated by averaging the 


terms outside the signal region. 


For a single path channel, such as in the case of the LOS signal, the TOA can be detected, by 
searching for the path with the strongest signal power. For a multipath channel, in particular, 
when the first arriving path is not the strongest (e.g., under ETU channel), the TOA estimation 
becomes biased. Usually, a threshold is needed to determine the first arriving path. Especially 
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in the case of strong noise and interference from multiple cells, the metric A(t) may not provide 
sufficient accuracy. Consider 


E{IROP} — NemePsy(t — 
ymb sy( o 
vn F + 1 = NeymbSNR(t) +1, (28) 


where SNR(t) := PUD is the SNR for each correlation sample, and it holds 


E? IRI? 
SNR(t) = 1 ga ) (29) 
f 


N symb 


The following criterion then takes a fixed SNR value as a threshold to estimate the first tap 


t= min t st. SNR()>SNRu. (30) 


uo St<uo+G—1 


SNRa is the required SNR for detection, which can be set as, e.g., —13 dB for 3GPP Release 9 
OTDOA measurement. 


4.3. Adaptive-threshold-based first tap detection 


As sı(n) is not ideally autocorrelated, the noise floor N; would contain further terms besides 


P;Nsymb o*. Therefore, we can express the noise floor as 


Nr ze BEN eee a EIN eb), (31) 


where £(Nsymb) is a parameter related to Nsymb, Sı(n), and y‚(n) and y,(n) is in turn dependent 
on the channel and the interference. 


Here, we use a criterion, which jointly considers the noise power and the received signal power 
to determine a varying (adaptive) detection threshold. Assume the metric peak relying on the 
signal power and noise is 


Amx = max ESRAR). (32) 


uo St<uo+G—1 


The adaptive threshold can then be defined as At, = @\/AmaxNy- Alternatively, the threshold 
can be defined as Ay, = a(BAmax + (1 = ß) Nf), where a is a design parameter, 6 € [0,1] is a 
constant trading-off between the noise floor and the metric peak. a and ß were determined 
through simulations, to have a trade-off for different channels and different SNRs. 


Given the threshold, the criterion for the adaptive threshold detection can be expressed as 


t= min t st. ER b> Am. (33) 


uo <t<ug+G—-1 
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This criterion usually leads to better performance especially under a multipath channel, and in 
some cases can achieve performance close to the CRLB [13]. 


LTE supports bandwidths up to 20 MHz, which corresponds to a sampling rate of 30.72 x 10° 
samples/s in the baseband signal. For a bandwidth smaller than 20 MHz, the processing can be 
done at a smaller sampling rate to reduce the processing load; e.g., when the channel has a 
bandwidth of 1.4 MHz, 1/16 of the rate is sufficient. However, better accuracy can be obtained 
by a higher sampling rate due to the receive diversity gain. 


5. Cooperation for accurate and reliable mobile radio positioning 


5.1. Cooperative positioning principle 


Future wireless technologies such as 5G enable UEs to cooperate with each other. By mutually 
observing their transmitted signals, UEs can estimate the ranges among themselves. If the 
mesh of mutually observed D2D links is sufficiently dense, positioning works even if there 
are less than three BSs visible to individual UEs as shown in Figure 2. For ranging, it is 
sufficient that the receiving UE knows at least parts of the signal transmitted by adjacent UEs. 
Pilots, such as CRS, PRS in 4G, which are multiplexed in a UE’s transmit signal stream anyway, 
can be used for that purpose. Another option is to transmit dedicated ranging signals, which 
are multiplexed into the UE’s transmit signal stream from time to time. However, there is no 
need to establish mutual connections between UEs. 


Figure 10a and b shows examples for cooperative positioning in indoor environments. In such 
areas, we find a lot of “things” that will be connected. Such devices are, e.g., smartphones, 
laptops, WLAN, or 5G access points (APs), but also consumer electronics like smart TVs or 
even home appliances like fridges, dishwashers, washing machines, etc. Many of these 
“things” of the internet are stationary as shown in the example in Figure 10a. Still, their 


Figure 10. Cooperative positioning indoors. The image on the right is licensed under CC BY-SA 3.0. It is built upon 
https://commons.wikimedia.org/wiki/File:Mirdif_City_Centre_indoor.JPG by Shahroozporia (own work) [CC BY-SA 3.0 
(http://creativecommons.org/licenses/by-sa/3.0)], via Wikimedia commons (a) Home area, (b) A shopping mall. 
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position might be unknown and must be determined similar to the mobile devices. The a priori 
knowledge that they do not move can be exploited in that context. Highly mobile things of 
daily use, like glasses, dog, or cat collar, may be equipped with low-cost transmitters in future. 
Thus, also these items, which are often lost, become traceable with cooperative positioning 
methods. Signals from outside the home, like BSs, GPS-equipped UEs outside, etc., might also 
be received under good LOS propagation conditions. These observations extend the mesh of 
connected devices and allow positioning in a global coordinate system. In shopping mall 
areas, as shown in Figure 10b, the density of mobile communication devices like smartphones 
is usually high. With a dense mesh of such devices, LOS propagation conditions among 
adjacent devices are highly probable, providing accurate ranging capabilities. The mesh 
reaches outdoor areas through devices near entrances or windows. Meshed devices outdoors 
can use GPS positioning and serve as a kind of anchor for devices’ indoors. Also, stationary 
indoor APs can serve as anchors. Their positions may have to be determined. 


5.2. Cooperative position calculation in mobile radio networks 


e Centralized, network centric: UEs transmit their measured ranges to adjacent UFs to a 
network positioning entity, which calculates the positions of the UEs and provides the 
position estimates to the UEs. This needs a protocol for exchanging information between 
UEs and the positioning entity. The protocol overhead might cause latency for position 
estimation, which might be negligible for pedestrians. 
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Figure 11. Cooperative vs. non-cooperative positioning performance. 
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e Decentralized, UE based: UFs share their currently estimated state (including uncertainty) to 
their vicinity. A protocol, which allows broadcasting this information, is needed for that 
purpose. The state to be shared (broadcasted) includes position and timing estimates, i.e., 
the offset of the local UE time base to the global system time base. Based on this, individual 
UEs can estimate their own position locally. This approach allows a “listen-only” mode. A 
“listen-only” UE does not share its own state estimates, but is still able to calculate a 
position fix based on the observed signals and state estimates from its neighboring UEs. 


Figure 11 shows results about the expectable cooperative positioning performance versus the 
UE density [21]. UEs have been uniformly distributed in a triangular area between three BSs as 
shown in Figure 2. The simulation parameters are summarized in Table 2. For non- 
cooperative positioning, the UEs’ positions are calculated individually. Thus, the positioning 
error does not depend on the UE density. For cooperative positioning, however, there is a 
significant performance gain for UE densities in the order of 1000 UEs per km? and above. The 
example shown in Figure 12 provides a relation to a density of 1000 UEs per km?, which 
comprises four sites in a typical urban living area. Each of the living sites may contain devices 


Parameter Value 

Carrier frequency fe 5 GHz 

Base station TX power Pgs 30 dBm 

Base station TX signal bandwidth Bes 5 MHz, uniform power spectrum density 

Mobile terminal TX power Pug 20 dBm 

Mobile terminal TX signal bandwidth Bur 1 MHz, uniform power spectrum density 

Noise power spectral density No No = kg T 

Boltzmann constant kg 1.381 x 107” J/K 

Noise temperature T 300 K 

Propagation model BS-UE WINNER C2 Typical Urban, additional ranging error of 
150 m if link is in NLOS condition 

Propagation model D2D free space, communication range is limited to reom = 50 m 

Base station distance dgs 400 m 

Number of UEs Nug 1,...,160 


Table 2. System parameters for cooperative positioning simulations. 


Figure 12. 1000 UEs per km? means 1 UE per 1000 m°. 
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as shown in Figure 10a. In shopping malls, as shown in Figure 10b, user densities are usually 
much higher. 5G envisages device densities of 10° per km? or 1 UE per m”. 


6. Conclusions 


5G is envisaged to support a variety of use cases and therefore needs to support precise 
positioning in many cases. With higher carrier bandwidth, TOA and related measurements 
can be done precisely. Cooperative positioning will benefit from the dense network and D2D 
communications. All these will contribute to high-accuracy positioning. In this chapter, we 
overviewed positioning requirements for wireless communications and the relevant radio- 
based positioning techniques. Then, we discussed the CRLB and ZZLB. With a simple ML- 
based adaptive threshold method, the first path of the radio signal can be detected with high 
accuracy for many wireless channels, especially when LOS is strong. In massively connected 
IoT, cooperative positioning will provide a further way for precise radio-based positioning. 
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